CVE-2016-1856 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Apple Iphone OS

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer16 documents5 sources
Severity
8.8HIGHNVD
EPSS
0.6%
top 30.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Apple Iphone OSApple SafariApple Tvos+2 more
Timeline
PublishedMay 20
Latest updateMay 14

Description

WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1854, CVE-2016-1855, and CVE-2016-1857.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages7 packages

▶NVDapple/tvos< 9.2.1
▶NVDapple/safari< 9.1.1
▶Appleapple/tvos9.2.1
▶Appleapple/safari9.1.1
▶NVDapple/iphone_os< 9.3.2

🔴Vulnerability Details

8
GHSA
GHSA-85vp-6cqm-7qc3: WebKit, as used in Apple iOS before 9↗2022-05-14
▶
GHSA
GHSA-68cm-fjjx-wg58: WebKit, as used in Apple iOS before 9↗2022-05-14
▶
GHSA
GHSA-6m76-6xhh-37hj: WebKit, as used in Apple iOS before 9↗2022-05-14
▶
GHSA
GHSA-p26q-77vf-4pcg: WebKit, as used in Apple iOS before 9↗2022-05-14
▶
OSV
CVE-2016-1857: WebKit, as used in Apple iOS before 9↗2016-05-20
▶

📋Vendor Advisories

4
Ubuntu
WebKitGTK+ vulnerabilities↗2016-09-14
▶
Apple
CVE-2016-1856: Safari 9.1.1↗
▶
Apple
CVE-2016-1856: iOS 9.3.2↗
▶
Apple
CVE-2016-1856: tvOS 9.2.1↗
▶
CVE-2016-1856 — Apple Iphone OS vulnerability | cvebase